Why are websites shutting down worldwide? PHP security emergency explained

The internet is under a severe security risk as researchers found two dangerous vulnerabilities in PHP, a programming language that powers millions of websites around the globe.

The discovery prompted governments and major organisations to temporarily shut down websites on Wednesday as cybersecurity experts scrambled to prevent hackers from exploiting the vulnerabilities.

What exactly is PHP, and why has it caused a worldwide emergency?

Websites use PHP as a processing language to act behind the scenes to process information, control databases and produce web pages.

It runs about 70% of all web pages, so weaknesses in the software could be a widespread problem, according to cybersecurity firm Wiz.

The two flaws, collectively dubbed “PHP2Shell”, could allow hackers to take control of vulnerable servers without needing a password.

Both of the vulnerabilities were rated as critical with a score of 9.2 out of 10.

Interestingly, artificial intelligence played a role in identifying the security weaknesses, highlighting how the technology is increasingly being used to discover vulnerabilities.

As a precaution, government websites in a number of countries, including Finland and Netherlands, were put temporarily offline.

Some services operated by the BBC and Australia's government were also affected by emergency security measures.

But it doesn't mean that all PHP-based sites were hacked.

The PHP development team has issued emergency updates to address the issue on October 21 and asked website administrators to install them ASAP.

Cybersecurity agencies have warned that organisations unable to apply the fixes should consider temporarily taking vulnerable services offline.

For regular web surfers, the immediate consequence could be website downtimes instead of device issues.

Nevertheless, security specialists warn that unpatched websites could remain vulnerable to cyberattacks even after the initial emergency has passed.